OpenClaw Malicious Skills: Over 1,100 Found as Agent Goes Viral

From GitHub darling to security headache

OpenClaw's rise was fast by any standard. In the last week of January 2026, the autonomous AI agent picked up 25,000 GitHub stars in a single day 2. GitHub itself calls it the fastest-growing project in the platform's history and has profiled the maintainers working to build and secure it 4. Within roughly three weeks of that surge, though, the project faced a security crisis on several fronts at once 12.

Three problems overlapped: a critical remote code execution bug, a poisoned skills marketplace, and a large population of internet-exposed instances. Each is serious on its own. Together, they show what happens when an agent with deep system access spreads faster than the guardrails around it.

The one-click RCE: CVE-2026-25253

The headline vulnerability, CVE-2026-25253, carries a CVSS score of 8.8 and allows a one-click remote code execution chain 1. According to Admin By Request's breakdown, the root cause was a trust assumption: OpenClaw treated any connection coming from localhost as implicitly safe 2. Websites can also originate connections from that address. A user who visited a malicious page could have JavaScript silently open a WebSocket to the OpenClaw gateway, steal the authentication token, and take over the gateway 2. Conscia notes that the attack works even against instances bound only to localhost. The flaw was patched in version 2026.1.29 1.

This class of bug is not new. Local services that trust the loopback interface have been burned by browser-originated requests before. It matters more here because the thing being compromised is an agent built to act on a user's behalf.

ClawHub's supply-chain problem, by the numbers

The skills marketplace, ClawHub, is where the counts diverge most between reports.

• The initial campaign. The operation dubbed ClawHavoc first turned up 341 malicious skills, about 12% of the registry. Most of them delivered the Atomic macOS Stealer (AMOS) 12.
• Later scans. Conscia reports that updated scans found more than 800 malicious skills, roughly 20% of the registry 1.
• The largest count. CyberDesserts puts the total at more than 1,184 malicious skills. It cites independent audits finding about one in twelve packages carrying malicious payloads as the registry grew past 13,700 skills 3.

These figures are not necessarily contradictory. They look like snapshots of a registry that was growing quickly and being scanned repeatedly. The absolute count of bad skills went up, while the percentage fell as legitimate submissions piled in. One in twelve across nearly 14,000 packages works out to roughly the 1,100-plus figure. Either way, the rate is far higher than anything a mature package ecosystem would tolerate.

Exposed instances: 30,000 or 135,000?

The sources also disagree on how many OpenClaw deployments sit on the open internet. Conscia cites more than 30,000 exposed instances, identified by scanning teams including Censys, Bitsight and Hunt.io, many without authentication 1. Admin By Request gives a much larger figure: over 135,000 publicly exposed instances with zero authentication 2.

The gap probably reflects different methods and timing, so the exact number is uncertain. The direction is not. Tens of thousands of agents, at minimum, have been reachable by strangers.

Why agents raise the stakes

CyberDesserts frames the risk through the "lethal trifecta" for AI agents: untrusted execution, access to private data, and external connectivity 3. OpenClaw has all three. It can read files, reach browser data and use API keys stored in plaintext configuration files under ~/.clawdbot/.env and ~/.openclaw/credentials/ 3.

That combination changes what a malicious skill can do. In a normal registry-poisoning incident, a bad package runs with whatever permissions the developer's build has. Here it runs inside an autonomous agent with system-level reach and stored credentials 3.

The problem also reaches beyond the main tool. Wiz researchers found a misconfigured Supabase database belonging to Moltbook, a social network adjacent to OpenClaw 3.

Corporate networks are already affected. Bitdefender GravityZone telemetry shows OpenClaw running on corporate endpoints 1. That makes it a shadow-IT problem: employees installing a powerful agent on work machines without security teams knowing.

The takeaway

The most useful lesson is not that OpenClaw is uniquely careless. It is that viral adoption shrank the usual window between "interesting project" and "attack target" to a few weeks.

• The RCE was patched quickly 1.
• The marketplace and exposure problems are structural and harder to fix with a single release.

Organizations should treat autonomous agents like any other privileged software:

1. Inventory where they run.
2. Require authentication on any exposed gateway.
3. Keep installations current with patches.
4. Treat third-party skills as untrusted code until vetted.

The maintainers GitHub has highlighted are clearly working on security 4. Until registry vetting catches up with growth, though, users carry much of the risk themselves.